Security

Application events stops forwarding

rbal_splunk
Splunk Employee
Splunk Employee

We are noticing on an exchange server that gets lots of application events, after a given timeframe it stops forwarding application events, yet it still continues to send System and Security. Restarting the service the application events start to forward again, but then stop after a given timeframe.

The particular server is running Universal Forwarder version 5.0.1.
…/etc/system/local /inputs.conf [WinEventLog:Application]
.. /etc/system/local/inputs.conf checkpointInterval = 5
.. /etc/system/local/inputs.conf current_only = 1
.. /etc/system/local/inputs.conf disabled = 0
.. /etc/system/local/inputs.conf host = test
.. /etc/system/default/inputs.conf index = default
.. /etc/system/local/inputs.conf start_from = oldest

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

This issue got resolved after upgrading the Universal Forwarder to 6.0. Event Process in 6.0 is multi-threaded and that seems to have helped in this case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...